Users that aren't sudoers can't write SD images

Question

I'm running Ubuntu 16.04 on my laptop. My son has a Raspberry Pi and uses my laptop to write SD card images as it had an integrated card reader.

Whilst he can mount, format, read and write the cards he cannot write an image without getting me to enter my password. Is there a group I can add him to to allow him to write the image?

My account is in sudoers but I don't want to grant my son's account full superuser rights.

Answer 1

If your son is using Etcher, there is no way to prevent privilege escalation because Etcher always tries to escalate privileges when trying to write, even if it doesn't have to.

If he is using dd, you can simply provide user access to the device using a udev rule.

If you want to limit it to a specific SD card, first run the following command with the sdcard inserted:

udevadm info -a /dev/mmcblk0 | grep cid

and note down the value in quotes.

Now create the file /etc/udev/rules.d/50-mmc-uaccess.rules with the following contents:

ACTION=="add", SUBSYSTEM=="block", KERNEL=="mmcblk*", ATTRS{cid}=="[card's cid]", TAG+="uaccess"

Replace [card's cid] with the value you noted down.

If you want to provide access to every SD card, just omit the ATTRS... part:

ACTION=="add", SUBSYSTEM=="block", KERNEL=="mmcblk*", TAG+="uaccess"

Now you can dd to it without sudo.

Answer 2

Q:

Is there a group I can add my son to to allow him to write an image without entering a password?

A:

Yes,it is possible, but you should think twice, because the tools/methods to write an SD image can be used in ways to cause severe damage to your operating system including valuable files. There is a reason why you need sudo for such tasks.

A simple method is to let your son boot into a live system from an Ubuntu live USB drive, where he can run sudo without any password, only press the Enter key when asked for password. But he will also be able to overwrite your internal drive by mistake.